A method, device and equipment for detecting Ethereum phishing accounts

Abstract

The present invention provides an Ethereum network phishing account detection method, device, and equipment. The method comprises: sampling an effective time series of the Ethereum transaction network using a dynamic random walk; representing the sampled data as a discrete dynamic weighted directed multigraph; performing image signal processing on the discrete dynamic weighted directed multigraph to determine a graph signal for each time snapshot, wherein the graph signal includes different dimensional features of each node in the time snapshot; inputting the discrete dynamic weighted directed multigraph and the graph signal of each time snapshot into a pre-trained detection network for phishing detection, determining a phishing score for each node, wherein the phishing score represents the probability that the corresponding node is a phishing account; and determining phishing accounts in the transaction network based on the phishing score of each node. The Ethereum network phishing account detection method of the present invention can effectively and accurately identify phishing accounts.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain security and network security technology, and specifically relates to an Ethereum phishing account detection method, device and equipment. Background Art

[0002] With the rise of decentralized finance (DeFi) and smart contract applications, phishing attacks have become a serious security threat. Attackers use fake contracts and forged websites to conduct phishing attacks, exploiting gaps in user knowledge of blockchain technology to steal private information or funds. These attacks are highly covert and destructive, causing significant financial losses to users and blockchain platforms. Traditional phishing detection research has primarily focused on identifying suspicious phishing websites and detecting phishing emails and messages. In contrast, the transparency and traceability of blockchain technology make it possible to detect suspicious phishing addresses and track stolen funds by analyzing transaction data and fund flows. This data contains rich information such as transaction amounts, transaction directions, and transaction addresses, facilitating in-depth analysis and identification of phishing campaigns. Early approaches relied on manual feature extraction and traditional machine learning methods. Currently, methods based on graph representation learning, such as network embedding and graph neural networks, are becoming mainstream. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide an Ethereum phishing account detection method, device and equipment that can effectively and accurately identify and determine phishing accounts.

[0004] The present invention provides a method for detecting Ethereum phishing accounts, comprising:

[0005] Use dynamic random walk to sample effective time series of Ethereum transaction network;

[0006] Representing the sampled data as a discrete dynamic weighted directed multigraph, wherein the dynamic weighted directed multigraph includes a time snapshot corresponding to each time step, wherein the time snapshot forms a weighted directed multigraph, and the weighted directed multigraph represents the transaction volume between the nodes involved in the corresponding time step, wherein each node represents an account;

[0007] Performing image signal processing on the discrete dynamic weighted directed multigraph to determine a graph signal of each of the time snapshots, wherein the graph signal includes different dimensional features of each node in the time snapshot;

[0008] Inputting the discrete dynamically weighted directed multigraph and the graph signal of each time snapshot into a pre-trained detection network for phishing detection, and determining a phishing score for each node, wherein the phishing score represents the probability that the corresponding node is a phishing account;

[0009] Phishing accounts in the transaction network are identified based on the phishing score of each node.

[0010] In one embodiment, the sampling of effective time series of the transaction network using the dynamic random walk of Ethereum includes:

[0011] Normalizing the transaction amounts and transaction times in the transaction network;

[0012] Calculating a normalized time deviation distribution of the transaction network;

[0013] Calculating the normalized weight of the time interval between each historical transaction time and the current time in the trading network based on an exponential function, wherein the shorter the time interval, the greater the weight value;

[0014] Determine the initial transaction time and initial edge of the random walk based on the time deviation distribution and the time interval weight;

[0015] Performing a random walk based on the initial transaction time and the initial edge;

[0016] Determine the neighboring nodes of the current node on the edge, and determine the next node to roam to from the neighboring nodes based on the transaction amount and transaction frequency involved between the node and the neighboring nodes;

[0017] The effective time series is obtained based on the nodes and edges that have been traversed.

[0018] In one embodiment, the method further comprises:

[0019] Set the number of walks per node, the minimum length of each walk, the maximum length of each walk, and the context window count;

[0020] Random walks are performed in the trading network using the number of walks of each node, the minimum length of each walk, the maximum length of each walk, and the context window count as walk rules to obtain the valid time series.

[0021] In one embodiment, determining the graph signal of each of the time snapshots includes:

[0022] Based on the information in the time snapshot, the in-degree, out-degree, degree, incoming transaction amount, outgoing transaction amount, total transaction amount, number of first-order neighbor nodes, and the inverse of the transaction frequency of each node in the time snapshot are calculated, where the inverse of the transaction frequency is determined based on the time span between the first and last transactions of the node divided by its degree.

[0023] In one embodiment, the pre-trained detection network is trained by the following steps:

[0024] Construct a diffusion convolutional evolutionary recursive neural network as the initial network;

[0025] The initial network is trained using a training time snapshot and a graph signal calculated based on the training time snapshot as training data, and based on a stochastic gradient algorithm and a cross-entropy loss function to obtain the detection network. The training includes calculating convolution filter parameters, calculating node embeddings, and calculating fishing scores.

[0026] In one embodiment, the calculation of the convolution filter parameters includes:

[0027] Based on the diffusion convolution layer in the initial network, a diffusion convolution operation is performed on the graph signal and the filter using the time snapshot to map the P-dimensional features of the graph signal to Q-dimensional output features;

[0028] Combine the gated recurrent unit to process the input features of the current moment and the output features of the previous moment to obtain the reset gate and update gate corresponding to the current moment, and combine the reset gate and update gate to calculate and update the output features of the diffusion convolution layer at the current moment. The output features form the node embedding of the corresponding node;

[0029] The gated recurrent unit is used to calculate and determine the parameters of the filter at the current moment based on the filter parameters at the previous moment, the reset gate at the current moment, and the update gate.

[0030] In one embodiment, the calculation of the node embedding includes:

[0031] The gated recurrent unit is used to calculate and update the output features of the diffusion convolution layer at the current moment by taking the output features of the diffusion convolution layer at the previous moment as input and the output features of the diffusion convolution layer at the previous moment as the hidden state of the trading network.

[0032] In one embodiment, the calculation of the fishing score includes:

[0033] The updated output features are calculated using the Softmax activation function to determine the fishing score of each node.

[0034] Another embodiment of the present invention also provides an Ethereum phishing account detection device, comprising:

[0035] Sampling module, used to sample effective time series of Ethereum transaction network using dynamic random walk;

[0036] a representation module for representing the sampled data as a discrete dynamic weighted directed multigraph, wherein the dynamic weighted directed multigraph includes a time snapshot corresponding to each time step, wherein the time snapshot forms a weighted directed multigraph, and wherein the weighted directed multigraph represents the transaction volume between nodes involved in the corresponding time step, wherein each node represents an account;

[0037] a processing module, configured to perform image signal processing on the discrete dynamically weighted directed multigraph to determine a graph signal of each of the time snapshots, wherein the graph signal includes different dimensional features of each node in the time snapshot;

[0038] a detection module, configured to input the discrete dynamically weighted directed multigraph and the graph signal of each time snapshot into a pre-trained detection network to perform phishing detection and determine a phishing score for each node, wherein the phishing score represents a probability that the corresponding node is a phishing account;

[0039] The determination module is used to determine the phishing accounts in the transaction network based on the phishing score of each node.

[0040] Another embodiment of the present invention further provides an electronic device, including:

[0041] one or more processors;

[0042] a memory configured to store one or more programs;

[0043] When the one or more programs are executed by the one or more processors, the one or more processors implement the Ethereum phishing account detection method as described in any one of the above.

[0044] The beneficial effects of the present invention include that, compared to existing solutions that directly obtain all transactions for processing, the solution of the present application can capture effective time transaction sequences, accurately preserve the graph structure and characteristics of the transaction network, improve data utilization, and reduce data processing volume. Moreover, compared to the detection models in existing solutions, the detection model constructed by the present application can fully capture the structural and temporal dynamic characteristics of the phishing network, and can adapt to the ever-changing transaction network in real time, automatically update parameters and node embedding, enhance the model's adaptability to network dynamics, achieve comprehensive capture of the dynamic characteristics of the phishing network, and ultimately accurately identify and determine the phishing node, significantly improving the capture efficiency of the phishing node compared to existing solutions.

[0045] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present application. The purposes and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0046] The technical solution of the present application is further described in detail below through the accompanying drawings and examples. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0048] Figure 1 Schematic diagram of the process of detecting Ethereum phishing accounts in an embodiment of the present invention.

[0049] Figure 2 2 is a flow chart of an Ethereum phishing account detection method according to another embodiment of the present invention.

[0050] Figure 3 2 is a structural block diagram of an Ethereum phishing account detection device in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings, but are not intended to limit the present invention.

[0052] It should be understood that various modifications may be made to the embodiments disclosed herein. Therefore, the following description should not be considered as limiting, but merely as an example of an embodiment. Other modifications within the scope of the present disclosure will occur to those skilled in the art.

[0053] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the general description of the present disclosure given above and the detailed description of the embodiments given below, serve to explain the principles of the present disclosure.

[0054] These and other characteristics of the invention will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0055] It should also be understood that although the invention has been described with reference to certain specific examples, those skilled in the art will be able to realize many other equivalent forms of the invention that have the characteristics recited in the claims and are therefore within the scope of protection defined thereby.

[0056] The above and other aspects, features and advantages of the present disclosure will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings.

[0057] Specific embodiments of the present disclosure will be described hereinafter with reference to the accompanying drawings; however, it should be understood that the disclosed embodiments are merely examples of the present disclosure, which may be implemented in a variety of ways. Well-known and / or repetitive functions and structures are not described in detail to avoid obscuring the present disclosure with unnecessary or redundant detail. Therefore, the specific structural and functional details disclosed herein are not intended to be limiting, but rather serve merely as a basis and representative basis for the claims to teach those skilled in the art to variously employ the present disclosure with substantially any suitable detailed structure.

[0058] This description may use the phrases "in one embodiment," "in another embodiment," "in a further embodiment," or "in other embodiments," each of which may refer to one or more of the same or different embodiments according to the present disclosure.

[0059] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0060] Current phishing node detection relies solely on manual feature engineering, which limits feature selection and makes it difficult to represent complex patterns in transaction data. Research using graph representation learning often treats the Ethereum transaction network as a static graph, simplifying multiple edges into a single edge. However, the dynamic evolution of the Ethereum network is crucial for capturing the characteristics of phishing behavior. While some methods consider time, they often assume that the graph topology is static and fail to fully capture the dynamic changes of the graph. Furthermore, many detection models based on graph neural networks (GNNs) typically focus only on the first-order neighborhood of a node, ignoring the deep relationships between multiple nodes. This approach can be ineffective, especially in coordinated attacks involving multiple phishing nodes.

[0061] To solve the above problems, Figure 1 As shown, an embodiment of the present invention provides an Ethereum phishing account detection method, comprising:

[0062] S1: Using dynamic random walk to sample effective time series of Ethereum transaction network;

[0063] S2: Representing the sampled data as a discrete dynamic weighted directed multigraph, wherein the dynamic weighted directed multigraph includes a time snapshot corresponding to each time step, wherein the time snapshot forms a weighted directed multigraph, and the weighted directed multigraph represents the transaction volume between the nodes involved in the corresponding time step, where each node represents an account;

[0064] S3: performing image signal processing on the discrete dynamic weighted directed multigraph to determine a graph signal of each of the time snapshots, wherein the graph signal includes different dimensional features of each node in the time snapshot;

[0065] S4: Inputting the discrete dynamically weighted directed multigraph and the graph signal of each time snapshot into a pre-trained detection network to perform phishing detection, and determining a phishing score for each node, wherein the phishing score represents the probability that the corresponding node is a phishing account;

[0066] S5: Determine phishing accounts in the transaction network based on the phishing score of each node.

[0067] Due to the complexity, periodicity and dynamics of the Ethereum transaction network, this embodiment first samples the network through dynamic random walks, and then represents the sampled time transaction sequence as a dynamic weighted directed multigraph containing multiple discrete time snapshots. , where T represents the number of time steps. Each time snapshot Form a weighted directed multigraph, including node set V, edge set and weighted adjacency matrix , represents the transaction volume between nodes at time step t. The node label is , where 1 represents the fishing node label and 0 represents the normal node label. These graphs are considered as valid time series, so that It can simultaneously preserve the local graph structure around node V and its time evolution behavior. That is, the valid time series is formed by valid transactions at different times, and each valid time series is equivalent to a subgraph of the transaction network graph G. Determine the graph signal of each time snapshot, assuming Represents a snapshot in time The graph signal, where P is the feature dimension of each node. The detection model in this embodiment is a model with Ethereum phishing detection as the goal, and the goal of Ethereum phishing detection is to learn a function , the function will The historical snapshots are mapped to the embedding representation of the corresponding graph of the entire transaction network. Specifically, given a graph , and classify the nodes in the future time snapshot into two categories, that is, determine the phishing nodes and normal nodes in the transaction network.

[0068] The method in this embodiment fully considers the dynamic evolution of the Ethereum transaction network, effectively preventing misjudgments of network topology and the inability to identify key trends in phishing networks. Furthermore, the use of a detection model improves judgment efficiency and accuracy. The detection model in this embodiment can effectively capture the deep relationships between multiple nodes in a phishing network. Because new transaction nodes and connections constantly emerge in Ethereum, in addition to phishing attacks that quickly lure targets in the short term, some attacks gradually build trust over time, masking their true intentions through long-term transaction relationships. Therefore, the detection model trained in this embodiment effectively overcomes the aforementioned issues, capable of analyzing transaction relationships that change over time and capturing complex structures and behavioral patterns between nodes. It can adapt to the dynamic evolution of the network and promptly identify newly emerging phishing nodes.

[0069] Furthermore, it can be seen from the above that the method in this embodiment mainly involves data sampling, graph signal processing, and the formation of a detection model. This process involves three key components, including: (1) Ethereum Dynamic Walker (EthdynWalker), which captures effective time transaction sequences; (2) Graph signal calculation to determine transaction features for each node in the discrete dynamic graph; (3) Diffused Convolution Evolutionary Recurrent Neural Network (DCERNN), which includes a diffuse convolution layer to capture local behavior patterns and structural information between multi-hop nodes, while using a recurrent neural network (RNN) to model temporal changes. The dynamic evolution of the diffuse convolution kernel is achieved through a parameter evolution mechanism, and the temporal changes of node embeddings are captured through an RNN-based embedding evolution mechanism.

[0070] In one embodiment, the sampling of effective time series of the trading network using dynamic random walks includes:

[0071] S6: Normalizing the transaction amount and transaction time in the transaction network;

[0072] S7: Calculating the normalized time deviation distribution of the transaction network;

[0073] S8: Calculating the normalized weight of the time interval between each historical transaction time and the current time in the trading network based on an exponential function, wherein the shorter the time interval, the greater the weight value;

[0074] S9: Determine the initial transaction time and initial edge of the random walk based on the time deviation distribution and the time interval weight;

[0075] S10: Performing a random walk based on the initial transaction time and the initial edge;

[0076] S11: Determine the neighboring nodes of the current edge node, and determine the next node to roam from the neighboring nodes based on the transaction amount and transaction frequency between the node and the neighboring nodes;

[0077] S12: Obtain the valid time series based on the nodes and edges that have been traversed.

[0078] The walker used in this embodiment traverses transactions in the order of timestamps and accurately captures the structure and time information in the original network by extracting valid time series. First, the transaction network is represented as a graph ,in represents a node set, represents the set of edges between nodes, is a function that sorts edges by transaction timestamp in ascending order, Map each edge to its corresponding transaction amount. Each edge Has a unique timestamp and transaction amount In Figure In, from arrive The time walk is a vertex sequence , satisfying the , , and for , . Represents a node set The elements in , where the subscript and Represents different elements .

[0079] Since most existing methods perform a fixed number of random walks on each node in the graph, they ignore the time factor. In order to explore the structural and temporal characteristics of the Ethereum phishing network, the method of this embodiment focuses on performing more time walks starting from the edges close to the current time point. This priority setting is intended to show that recent transactions are more important than earlier transactions. When performing random walks, the transaction amount and transaction time are first normalized and mapped to Then, the time deviation distribution of the normalized transaction network is determined, and an exponential function is used to calculate the weight of the time interval between each historical transaction time and the current moment, ensuring that the edges close to the current time have a larger weight. In this case, each edge is assigned a probability:

[0080]

[0081] described The value is based on the edge eThe sequence number used to sort the timestamps. is the minimum time associated with edge e in the dynamic graph. is the set of edges. The above formula uses exponential distribution to calculate a probability value for the selection of the initial edge.

[0082] Based on time deviation distribution, time interval weight self-time deviation distribution Extract the initial time of the walk , and the initial time edge . From the initial edge After starting the time walk, the next step is to select the target node for the time random walk. The neighbor set of From the collection In the process, the next node is selected for dynamic walking. It should be noted that the same neighboring nodes Maybe in Because multiple transactions may occur between the same account pair. In order to better reflect the activity pattern between fishing nodes, for each pair of consecutive edges and , the number of walks needs to be It is limited to a smaller range to maintain the time correlation between adjacent nodes. In addition, it is necessary to ensure that the transaction amount is not biased, because large transactions may involve fraud and other illegal activities, while small transactions may be used to verify phishing websites or phishing fraud activities. Based on this, this embodiment adopts a weight distribution To select the next neighbor node to walk to, given any edge , select each neighbor node (Characterization t Time Node The neighbor set of is a node in the set, The probability of neighbor nodes is as follows:

[0083]

[0084] in, Represents the mapping of corresponding time. The formula represents the time from the node at time t Select the next node from the neighbor set The probability of performing dynamic walks.

[0085] Further, such as Figure 2 As shown, the method further includes:

[0086] S13: Set the number of walks for each node, the minimum length of each walk, the maximum length of each walk, and the context window count;

[0087] S14: Performing random walks in the transaction network with the number of walks of each node, the minimum length of each walk, the maximum length of each walk, and the context window count as walk rules to obtain the valid time series.

[0088] Since the time factor is taken into account, the random walk may traverse all time-valid edges. Let the number of walks for each node be R, and the minimum length of each time walk be , the maximum length is L. Considering the generated effective time walk , which satisfies , then the context window count It can be calculated as follows:

[0089] .

[0090] Ethereum transactions exhibit a cyclical pattern that is influenced by factors such as trading activity and market conditions. Normal accounts maintain a relatively stable rhythm in sending and receiving transactions, while phishing accounts often experience bursts of trading activity in a short period of time, and the number of transactions received is significantly higher than the number of transactions sent. After these peaks of activity, as the activity weakens, there is usually a gradual transfer of large amounts of fraudulent assets. The method in this embodiment emphasizes improving the ability to capture the dynamic evolution characteristics of nodes and graph structures in the Ethereum transaction network. Due to the anonymity of the blockchain, nodes lack attribute characteristics, so information obtained from valid time transaction sequences must be used. To this end, this embodiment first calculates the graph signal in preparation for learning its dynamic characteristics, and the determination of the graph signal for each of the time snapshots includes:

[0091] S15: Based on the information in the time snapshot, calculate the in-degree, out-degree, degree, incoming transaction amount, outgoing transaction amount, total transaction amount, number of first-order neighbor nodes, and the reciprocal of the transaction frequency of each node in the time snapshot, where the reciprocal of the transaction frequency is determined based on the time span between the first and last transactions of the node divided by its degree.

[0092] Specifically, in-degree: the number of transactions received by a node. Fishing nodes usually have higher in-degree, while normal nodes show a more even distribution.

[0093] Outdegree: The number of transactions sent by a node. Fishing nodes typically have lower outdegrees, while normal nodes exhibit a more even distribution.

[0094] Degree: The sum of the in-degree and out-degree of a node.

[0095] Incoming transaction amount: The total amount received by the node, calculated as the sum of the weights of all incoming edges.

[0096] Outgoing transaction amount: The total amount sent by a node to other nodes, calculated as the sum of the weights of all outgoing edges.

[0097] Total transaction amount: The total amount of all transactions involving the node, including income and expenditure amounts.

[0098] Number of neighbors: The number of first-order neighbors of a node.

[0099] The inverse of transaction frequency: the time span between the first and last transaction of a node, divided by its degree.

[0100] By analyzing and modeling basic node behavior characteristics, the detection model can effectively capture node relationships and time patterns, thereby improving the accuracy of phishing node detection.

[0101] When constructing the detection model, the method further includes:

[0102] S16: Construct a Diffused Convolutional Evolved Recurrent Neural Network (DCERNN) as the initial network;

[0103] S17: Using training time snapshots and training node graph signals as training data, and training the initial network based on a stochastic gradient algorithm and a cross-entropy loss function to obtain the detection network, wherein the training includes calculating convolution filter parameters, calculating node embeddings, and calculating fishing scores.

[0104] Among them, the calculation of convolution filter parameters includes:

[0105] S18: performing a diffusion convolution operation on the graph signal and the filter using the time snapshot based on the diffusion convolution layer in the initial network to map the P-dimensional features of the graph signal to Q-dimensional output features;

[0106] S19: Processing the input features of the current moment and the output features of the previous moment in combination with the gated recurrent unit to obtain a reset gate and an update gate corresponding to the current moment, and calculating and updating the output features of the diffusion convolution layer at the current moment in combination with the reset gate and the update gate, wherein the output features form a node embedding of the corresponding node;

[0107] S20: Utilizing the gated recurrent unit, based on the filter parameters at the previous moment, the reset gate at the current moment, and the update gate, the current moment parameters of the filter are calculated and determined.

[0108] In the above embodiment, steps S18 and S19 include calculation of the diffusion convolution layer, and calculation of the convolution filter parameters is implemented based on the diffusion convolution layer. Step S20 is an iterative calculation process of the convolution filter parameters.

[0109] For example, the (DCERNN) includes a dilated convolutional layer whose input is a time snapshot , and its graph signal is , where P is the feature dimension. The input of the initial layer is set to the transaction feature vector of each node. Output is a new set of node representations with dimension Q reflecting a time snapshot Local structural properties within.

[0110] The diffusion convolution layer propagates and updates the interaction information between each node and its neighbors through multiple convolution operations, gradually capturing information from more distant nodes. and filter The diffusion convolution operation on is defined as:

[0111]

[0112] in, It is a graph signal, that is, a feature matrix with dimension , is the number of nodes, is the characteristic dimension. Indicates selecting all rows of the feature matrix Column values, . Filter function Indicates the image signal Perform transformations, operators Represents the diffusion convolution operation. The above symbols together represent the diffusion convolution operation on each column of the feature matrix. is the filter parameter, which can be regarded as a parameter matrix. represents the first column of the matrix, represents the second column of the matrix. Further, is a weighted adjacency matrix representing transaction amounts. is the out-degree diagonal matrix, is an in-degree diagonal matrix, where represents an all-one vector. Therefore, and Represent the transfer matrices of the diffusion process and its inverse process respectively. Operator represents the diffuse convolution, where represents the feature dimension, is a finite number of diffusion steps The filter parameters of .

[0113] Assigning a trainable weight to each step, through the convolution operation, the diffusion convolution layer can be used to map the P-dimensional features to Q-dimensional outputs:

[0114] .

[0115] in is the filter, is the parameter tensor, . No. input and The convolution filter parameters of the output are , is the activation function. Representation signal The hidden layer output after the diffusion convolution layer is an intermediate result, and the feature dimension is .

[0116] To learn representations of the Ethereum transaction graph using diffuse convolutional layers, this example uses a gated recurrent unit (GRU), a simple and efficient variant of the graph convolutional neural network (RNN) that captures temporal dependencies. In this model, matrix multiplication is replaced by diffuse convolution, specifically:

[0117] .

[0118] and denote the input and output at time t, respectively. and denote the reset gate and update gate at time t respectively. represents the diffusion convolution operation, 、 and is the parameter of the filter. tanh is the hyperbolic tangent activation function, is the bias vector for the reset gate, is the bias vector of the update gate, is a candidate hidden state The bias vector of is the final hidden state. By combining dilated convolution with GRU, the recurrent neural network can be trained through time backpropagation, effectively capturing the temporal and network structure dependencies in the Ethereum phishing network.

[0119] The core idea of ​​parameter evolution is to update the convolution filter parameters using current and historical data through a recursive architecture. The value at time t. For example, It is considered as the output of the Ethereum dynamic system, which evolves over time and serves as the input of the subsequent steps. In this embodiment, GRU is used to model the relationship between the input and output of the diffusion convolution layer. GRU is a recursive architecture, while DConv represents the graph signal. The diffusion convolution unit in the table. Time advances from left to right in the recursive architecture, and the layers are connected in a bottom-up manner. While performing graph convolution between layers, the parameters are also evolving. Filter parameters is the input and output of GRU. The output of DConv represents the hidden state of GRU, while the node embedding As input.

[0120] For example, the above process can be expressed as:

[0121] .

[0122] The origin of the above formula, that is, the realization of the parameter evolution in the above formula is as follows:

[0123] .

[0124] Among them, and Only used as a local variable. is the weight matrix of the reset gate, is the weight matrix of the update gate, is a candidate hidden state The weight matrix, , , is the hidden state of the previous moment The associated weight matrices are used to calculate the reset gate, update gate, and candidate hidden states, respectively. is a candidate hidden state The calculation of the node embedding includes:

[0125] S21: Utilize the gated recurrent unit to calculate and update the output features of the diffusion convolution layer at the current moment with the output features of the diffusion convolution layer at the previous moment as input and the output features of the diffusion convolution layer at the previous moment as the hidden state of the transaction network.

[0126] The core idea of ​​embedding evolution in this embodiment is to use current and historical information to update the node embedding at time t , thereby enhancing the model's ability to represent the dynamic network characteristics of Ethereum. This embodiment adopts a recursive architecture to consider the time evolution of nodes. As the input of GRU. As the hidden state of the Ethereum dynamic system. At time t, the hidden state is updated by the input to model and learn the temporal characteristics of the node. For example, it can be defined as:

[0127]

[0128] is the hidden state output by the diffusive convolutional layer at time t. is based on and the hidden state at the previous moment , updated by GRU to obtain the hidden state at the current moment. Embed the node that is the current node.

[0129] The evolution of the above formula is as follows:

[0130]

[0131] is the weight matrix of the reset gate, is the weight matrix of the update gate, is a candidate hidden state The weight matrix, , , is the hidden state of the previous moment The associated weight matrices are used to calculate the reset gate, update gate, and candidate hidden states, respectively. is a candidate hidden state The bias vector of .

[0132] The embedding evolution can improve the representation of node behavior, thereby improving the accuracy and efficiency of phishing node detection.

[0133] The calculation of the fishing score includes:

[0134] S22: Use the Softmax activation function to calculate the updated output features to determine the fishing score of each node.

[0135] In this example, after obtaining the node embedding, our goal is to use an end-to-end method to assign a fishing score to each node in the dynamic graph. The fishing score of each node embedding is calculated using the Softmax activation function and is defined as:

[0136]

[0137] in Indicates the fishing score, Representation category Node embedding. There are two categories: phishing accounts and normal accounts.

[0138] The training in this embodiment is iterative and end-to-end, specifically using the Adam algorithm with stochastic gradient and the cross entropy loss function to train the model. is 0; for fishing nodes, the label is 1. At training time snapshot Including nodes, so the loss function in this embodiment can be defined as:

[0139] .

[0140] c Indicates the account type, N Indicates the total number of nodes, Indicates the nodes, Represents the label value of the node, Represents the fishing score of the node.

[0141] Based on the above embodiments, it can be seen that the Ethereum dynamic walker designed by this application can be used to capture effective time transaction sequences. Secondly, the proposed diffuse convolutional evolutionary recurrent neural network (DCERNN) can capture multi-hop propagation information between nodes through diffuse convolution and perform spatial dependency modeling; and it can also capture the long-term dependencies of nodes through recurrent neural networks and perform temporal dependency modeling. At the same time, the solution of this application also introduces two evolutionary mechanisms, namely the parameter evolution mechanism and the embedding evolution mechanism, which are used to update the time changes of network parameters and node embeddings respectively. Through the above configuration, the solution of this application can have the following advantages:

[0142] The Ethereum dynamic walker can capture effective time transaction sequences and accurately preserve the graph structure and characteristics of the transaction network;

[0143] The evolutionary recurrent neural network based on diffuse convolution combines graph neural networks and sequence modeling methods to capture the structural and temporal dynamic characteristics of fishing networks from both spatial and temporal perspectives.

[0144] The evolutionary mechanism of DCERNN enables the model to adapt to the ever-changing transaction network in real time, automatically updating parameters and node embeddings, enhancing the model's adaptability to network dynamics and achieving comprehensive capture of the dynamic characteristics of phishing networks.

[0145] like Figure 3 As shown, another embodiment of the present invention also provides an Ethereum phishing account detection device 100, comprising:

[0146] Sampling module, used to sample effective time series of Ethereum transaction network using dynamic random walk;

[0147] a representation module for representing the sampled data as a discrete dynamic weighted directed multigraph, wherein the dynamic weighted directed multigraph includes a time snapshot corresponding to each time step, wherein the time snapshot forms a weighted directed multigraph, and wherein the weighted directed multigraph represents the transaction volume between nodes involved in the corresponding time step, wherein each node represents an account;

[0148] a processing module, configured to perform image signal processing on the discrete dynamically weighted directed multigraph to determine a graph signal of each of the time snapshots, wherein the graph signal includes different dimensional features of each node in the time snapshot;

[0149] a detection module, configured to input the discrete dynamically weighted directed multigraph and the graph signal of each time snapshot into a pre-trained detection network to perform phishing detection and determine a phishing score for each node, wherein the phishing score represents a probability that the corresponding node is a phishing account;

[0150] The determination module is used to determine the phishing accounts in the transaction network based on the phishing score of each node.

[0151] In one embodiment, the sampling of effective time series of the trading network using dynamic random walks includes:

[0152] Normalizing the transaction amounts and transaction times in the transaction network;

[0153] Calculating a normalized time deviation distribution of the transaction network;

[0154] Calculating the normalized weight of the time interval between each historical transaction time and the current time in the trading network based on an exponential function, wherein the shorter the time interval, the greater the weight value;

[0155] Determine the initial transaction time and initial edge of the random walk based on the time deviation distribution and the time interval weight;

[0156] Performing a random walk based on the initial transaction time and the initial edge;

[0157] Determine the neighboring nodes of the current node on the edge, and determine the next node to roam to from the neighboring nodes based on the transaction amount and transaction frequency involved between the node and the neighboring nodes;

[0158] The effective time series is obtained based on the nodes and edges that have been traversed.

[0159] In one embodiment, the apparatus further comprises:

[0160] The setting module is used to set the number of walks for each node, the minimum length of each walk, the maximum length of each walk, and the context window count;

[0161] The random walk module is used to perform random walks in the trading network based on the number of walks of each node, the minimum length of each walk, the maximum length of each walk, and the context window count as walk rules to obtain the valid time series.

[0162] In one embodiment, determining the graph signal of each of the time snapshots includes:

[0163] Based on the information in the time snapshot, the in-degree, out-degree, degree, incoming transaction amount, outgoing transaction amount, total transaction amount, number of first-order neighbor nodes, and the inverse of the transaction frequency of each node in the time snapshot are calculated, where the inverse of the transaction frequency is determined based on the time span between the first and last transactions of the node divided by its degree.

[0164] In one embodiment, the pre-trained detection model is obtained based on the following method:

[0165] Used to construct a diffusion convolutional evolutionary recurrent neural network as the initial network;

[0166] It is used to train the initial network using training time snapshots and training node graph signals as training data, and based on a stochastic gradient algorithm and a cross-entropy loss function to obtain the detection network. The training includes the calculation and evolution of convolution filter parameters, the calculation and evolution of node embeddings, and the calculation of fishing scores.

[0167] In one embodiment, the calculation of the convolution filter parameters includes:

[0168] Based on the diffusion convolution layer in the initial network, a diffusion convolution operation is performed on the graph signal and the filter using the time snapshot to map the P-dimensional features of the graph signal to Q-dimensional output features;

[0169] Combine the gated recurrent unit to process the input features of the current moment and the output features of the previous moment to obtain the reset gate and update gate corresponding to the current moment, and combine the reset gate and update gate to calculate and update the output features of the diffusion convolution layer at the current moment. The output features form the node embedding of the corresponding node;

[0170] The gated recurrent unit is used to calculate and determine the parameters of the filter at the current moment based on the filter parameters at the previous moment, the reset gate at the current moment, and the update gate.

[0171] In one embodiment, the calculation of the node embedding includes:

[0172] The gated recurrent unit is used to calculate and update the output features of the diffusion convolution layer at the current moment by taking the output features of the diffusion convolution layer at the previous moment as input and the output features of the diffusion convolution layer at the previous moment as the hidden state of the trading network.

[0173] In one embodiment, the calculation of the fishing score includes:

[0174] The updated output features are calculated using the Softmax activation function to determine the fishing score of each node.

[0175] Another embodiment of the present invention further provides an electronic device, including:

[0176] one or more processors;

[0177] a memory configured to store one or more programs;

[0178] When the one or more programs are executed by the one or more processors, the one or more processors implement the Ethereum phishing account detection method as described in any one of the above.

[0179] Furthermore, an embodiment of the present invention provides a storage medium storing a computer program that, when executed by a processor, implements the aforementioned Ethereum phishing account detection method. It should be understood that each solution in this embodiment has the corresponding technical effects of the aforementioned method embodiments and will not be further elaborated here.

[0180] Furthermore, an embodiment of the present invention also provides a computer program product, which is tangibly stored on a computer-readable medium and includes computer-readable instructions. When the computer-executable instructions are executed, at least one processor performs an Ethereum phishing account detection method such as the one in the embodiment described above.

[0181] It should be noted that the computer storage medium of the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable media may include, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage medium, a magnetic storage medium, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. In the present invention, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program configured for use by or in conjunction with an instruction execution system, system, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, antenna, optical cable, RF, or any suitable combination thereof.

[0182] Furthermore, those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage and optical storage) containing computer-usable program code.

[0183] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1a process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or boxes.

[0184] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction system that is implemented in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0185] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of protection of the present application is limited to these examples. In line with the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

Claims

1. A method for detecting Ethereum phishing accounts, characterized in that: include: Use dynamic random walk to sample effective time series of Ethereum transaction network; Representing the sampled data as a discrete dynamic weighted directed multigraph, wherein the dynamic weighted directed multigraph includes a time snapshot corresponding to each time step, wherein the time snapshot forms a weighted directed multigraph, and the weighted directed multigraph represents the transaction volume between the nodes involved in the corresponding time step, wherein each node represents an account; Performing image signal processing on the discrete dynamic weighted directed multigraph to determine a graph signal of each of the time snapshots, wherein the graph signal includes different dimensional features of each node in the time snapshot; Inputting the discrete dynamically weighted directed multigraph and the graph signal of each time snapshot into a pre-trained detection network for phishing detection, and determining a phishing score for each node, wherein the phishing score represents the probability that the corresponding node is a phishing account; Identify phishing accounts in the transaction network based on the phishing score of each node; The pre-trained detection network is trained through the following steps: Construct a diffusion convolutional evolutionary recursive neural network as the initial network; Using a training time snapshot and a graph signal calculated based on the training time snapshot as training data, and training the initial network based on a stochastic gradient algorithm and a cross-entropy loss function to obtain the detection network, wherein the training includes calculating convolution filter parameters, calculating node embeddings, and calculating fishing scores; The calculation of convolution filter parameters includes: Based on the diffusion convolution layer in the initial network, a diffusion convolution operation is performed on the graph signal and the filter using the time snapshot to map the P-dimensional features of the graph signal to Q-dimensional output features; Combine the gated recurrent unit to process the input features of the current moment and the output features of the previous moment to obtain the reset gate and update gate corresponding to the current moment, and combine the reset gate and update gate to calculate and update the output features of the diffusion convolution layer at the current moment. The output features form the node embedding of the corresponding node; Utilizing the gated recurrent unit, the filter parameters at the previous moment, the reset gate at the current moment, and the update gate are calculated to determine the parameters of the filter at the current moment; The calculation of the node embedding includes: Utilizing the gated recurrent unit to calculate and update the output features of the diffusing convolutional layer at the current moment using the output features of the diffusing convolutional layer at the previous moment as the hidden state of the transaction network; The calculation of the fishing score includes: The updated output features are calculated using the Softmax activation function to determine the fishing score of each node.

2. The Ethereum phishing account detection method according to claim 1, characterized in that: The method of sampling the effective time series of the Ethereum transaction network using dynamic random walk includes: Normalizing the transaction amounts and transaction times in the transaction network; Calculating a normalized time deviation distribution of the transaction network; Calculating the normalized weight of the time interval between each historical transaction time and the current time in the trading network based on an exponential function, wherein the shorter the time interval, the greater the weight value; Determine the initial transaction time and initial edge of the random walk based on the time deviation distribution and the time interval weight; Performing a random walk based on the initial transaction time and the initial edge; Determine the neighboring nodes of the current node, and determine the next node to roam to from among the neighboring nodes based on the transaction amount and transaction frequency involved between the node and the neighboring nodes; The effective time series is obtained based on the nodes and edges that have been traversed.

3. The Ethereum phishing account detection method according to claim 2, characterized in that: The method further comprises: Set the number of walks per node, the minimum length of each walk, the maximum length of each walk, and the context window count; Random walks are performed in the trading network using the number of walks of each node, the minimum length of each walk, the maximum length of each walk, and the context window count as walk rules to obtain the valid time series.

4. The Ethereum phishing account detection method according to claim 1, characterized in that: The determining of the graph signal of each of the time snapshots comprises: Based on the information in the time snapshot, the in-degree, out-degree, degree, incoming transaction amount, outgoing transaction amount, total transaction amount, number of first-order neighbor nodes, and the inverse of the transaction frequency of each node in the time snapshot are calculated, where the inverse of the transaction frequency is determined based on the time span between the first and last transactions of the node divided by its degree.

5. An Ethereum phishing account detection device, characterized in that: include: Sampling module, used to sample effective time series of Ethereum transaction network using dynamic random walk; a representation module for representing the sampled data as a discrete dynamic weighted directed multigraph, wherein the dynamic weighted directed multigraph includes a time snapshot corresponding to each time step, wherein the time snapshot forms a weighted directed multigraph, and wherein the weighted directed multigraph represents the transaction volume between nodes involved in the corresponding time step, wherein each node represents an account; a processing module, configured to perform image signal processing on the discrete dynamically weighted directed multigraph to determine a graph signal of each of the time snapshots, wherein the graph signal includes different dimensional features of each node in the time snapshot; a detection module, configured to input the discrete dynamically weighted directed multigraph and the graph signal of each time snapshot into a pre-trained detection network to perform phishing detection and determine a phishing score for each node, wherein the phishing score represents a probability that the corresponding node is a phishing account; A determination module, configured to determine phishing accounts in the transaction network based on the phishing score of each node; The pre-trained detection network is trained through the following steps: Construct a diffusion convolutional evolutionary recursive neural network as the initial network; Using a training time snapshot and a graph signal calculated based on the training time snapshot as training data, and training the initial network based on a stochastic gradient algorithm and a cross-entropy loss function to obtain the detection network, wherein the training includes calculating convolution filter parameters, calculating node embeddings, and calculating fishing scores; The calculation of convolution filter parameters includes: Based on the diffusion convolution layer in the initial network, a diffusion convolution operation is performed on the graph signal and the filter using the time snapshot to map the P-dimensional features of the graph signal to Q-dimensional output features; Combine the gated recurrent unit to process the input features of the current moment and the output features of the previous moment to obtain the reset gate and update gate corresponding to the current moment, and combine the reset gate and update gate to calculate and update the output features of the diffusion convolution layer at the current moment. The output features form the node embedding of the corresponding node; Utilizing the gated recurrent unit, the filter parameters at the previous moment, the reset gate at the current moment, and the update gate are calculated to determine the parameters of the filter at the current moment; The calculation of the node embedding includes: Utilizing the gated recurrent unit to calculate and update the output features of the diffusing convolutional layer at the current moment using the output features of the diffusing convolutional layer at the previous moment as the hidden state of the transaction network; The calculation of the fishing score includes: The updated output features are calculated using the Softmax activation function to determine the fishing score of each node.

6. An electronic device, characterized in that: include: one or more processors; a memory configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the Ethereum phishing account detection method according to any one of claims 1 to 4.

Images